AWS efs documentation change
Summary
Added documentation for IPv6 and dual-stack IP address support in EFS mount targets, including CLI examples and configuration requirements
Security assessment
The changes clarify IP address type configuration requirements and enforce alignment with subnet IP attributes. While this helps prevent misconfigurations that could lead to network exposure, there is no direct evidence of addressing a specific security vulnerability. The documentation adds guidance about secure network configuration practices.
Diff
diff --git a/efs/latest/ug/manage-fs-access-create-delete-mount-targets.md b/efs/latest/ug/manage-fs-access-create-delete-mount-targets.md index b0b740ba3..cb2656898 100644 --- a//efs/latest/ug/manage-fs-access-create-delete-mount-targets.md +++ b//efs/latest/ug/manage-fs-access-create-delete-mount-targets.md @@ -48 +48,7 @@ For One Zone file systems, you can only create a single mount target that is in - 2. Provide an IP address from the subnet where you are placing the mount target. If you omit a value, Amazon EFS selects an unused IP address from that subnet. + 2. For **IP address type** , choose **IPv4 only** to support IPv4 addresses only, **IPv6 only** to support IPv6 addresses only, or **Dual-stack** to support both IPv4 and IPv6 addresses. + +###### Note + +The IP address type must match the IP type of the subnet. Additionally, the IP address type overrides the IP addressing attribute of your subnet. For example, if the IP address type is IPv4-only and the IPv6 addressing attribute is enabled for your subnet, network interfaces created in the subnet receive an IPv4 address from the range of the subnet. For more information, see [Modify the IP addressing attributes of your subnet](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html). + + 3. If you know the IP address where you want to place the mount target, then enter it in the IP address box that matches the **IP address type**. If you don't specify a value, Amazon EFS selects an unused IP address from the specified subnet. @@ -61 +67,10 @@ You can't change the IP address of a mount target after it's created. To change -This section provides an example for creating a mount target in the AWS CLI using the `create-mount-target` command. The equivalent API command is [CreateMountTarget](./API_CreateMountTarget.html). +This section provide examples for creating a mount target in the AWS CLI using the `create-mount-target` command. The equivalent API command is [CreateMountTarget](./API_CreateMountTarget.html). + + * If you don't specify an IP address type for the mount target, then IPv4-only is used. + + * If you don't specify an IP address for the mount target, then Amazon EFS assigns an available address on the specified subnet. + + * The IP address type overrides the IP addressing attribute of your subnet. For example, if the IP address type is IPv4-only and the IPv6 addressing attribute is enabled for your subnet, network interfaces created in the subnet receive an IPv4 address from the range of the subnet. For more information, see [Modify the IP addressing attributes of your subnet](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html). + + + @@ -67 +82,109 @@ For One Zone file systems, you can only create a single mount target that is in -The following command specifies the file system, subnet, and security group for the mount target. The target is created at an available IP address on the specified subnet. +The following command specifies the file system, subnet, and security group for the mount target. The target is created at an available IPv4 address on the specified subnet. + + + $ aws efs create-mount-target \ + --file-system-id file-system-id \ + --subnet-id subnet-id \ + --security-group ID-of-the-security-group-created-for-mount-target \ + --region aws-region \ + +The following example shows the command with sample data. + + + $ aws efs create-mount-target \ + --file-system-id fs-0123456789abcdef1 \ + --subnet-id subnet-b3983dc4 \ + --security-group sg-01234567 \ + --region us-east-2 \ + +After successfully creating the mount target, Amazon EFS returns the mount target description as JSON as shown in the following example. + + + { + "OwnerID": "111122223333" + "MountTargetId": "fsmt-f9a14450", + "FileSystemId": "fs-0123456789abcdef1", + "SubnetId": "subnet-b3983dc4", + "LifeCycleState": "available", + "IpAddress": "10.0.1.24", + "NetworkInterfaceId": "eni-3851ec4e", + "AvailabilityZoneId": "use2-az1", + "AvailabilityZoneName": "us-east-2a", + "VpcId": "vpc-3c39ef57" + } + +The following command specifies the file system, subnet, security group, and IPv4 address to use for the mount target. The target is created at the specified IPv4 address on the specified subnet. + + + $ aws efs create-mount-target \ + --file-system-id file-system-id \ + --subnet-id subnet-id \ + --security-group ID-of-the-security-group-created-for-mount-target \ + --ip-address IPv4-address + --region aws-region \ + +The following example shows the command with sample data. + + + $ aws efs create-mount-target \ + --file-system-id fs-0123456789abcdef1 \ + --subnet-id subnet-b3983dc4 \ + --security-group sg-01234567 \ + --ip-address 10.0.1.24 \ + --region us-east-2 \ + +After successfully creating the mount target, Amazon EFS returns the mount target description as JSON as shown in the following example. + + + { + "OwnerID": "111122223333" + "MountTargetId": "fsmt-f9a14450", + "FileSystemId": "fs-0123456789abcdef1", + "SubnetId": "subnet-b3983dc4", + "LifeCycleState": "available", + "IpAddress": "10.0.1.24", + "NetworkInterfaceId": "eni-3851ec4e", + "AvailabilityZoneId": "use2-az1", + "AvailabilityZoneName": "us-east-2a", + "VpcId": "vpc-3c39ef57" + } + +The following command specifies the file system, subnet, security group, and IPv6 address to use for the mount target. The target is created at the specified IPv6 address on the specified subnet. + + + $ aws efs create-mount-target \ + --file-system-id file-system-id \ + --subnet-id subnet-id \ + --security-group ID-of-the-security-group-created-for-mount-target \ + --ip-address-type IP-address-type \ + --ipv6-address IPv6-address \ + --region aws-region \ + +The following example shows the command with sample data. + + + $ aws efs create-mount-target \ + --file-system-id fs-0123456789abcdef1 \ + --subnet-id subnet-b3983dc4 \ + --security-group sg-01234567 \ + --ip-address-type IPV6_ONLY \ + --ipv6-address 2001:0db8:85a3:0000:0000:8a2e:0370:7334 \ + --region us-east-2 \ + +After successfully creating the mount target, Amazon EFS returns the mount target description as JSON as shown in the following example. + + + { + "OwnerID": "111122223333" + "MountTargetId": "fsmt-f9a14450", + "FileSystemId": "fs-0123456789abcdef1", + "SubnetId": "subnet-b3983dc4", + "LifeCycleState": "available", + "Ipv6Address": "2001:0db8:85a3:0000:0000:8a2e:0370:7334", + "NetworkInterfaceId": "eni-3851ec4e", + "AvailabilityZoneId": "use2-az1", + "AvailabilityZoneName": "us-east-2a", + "VpcId": "vpc-3c39ef57" + } + +The command specifies the file system, subnet, security group, dual-stack IP address type, and IPv6 address for the mount target. The target is created at an available IPv4 address and the specified IPv6 address on the dual-stack subnet. @@ -73,0 +197,2 @@ The following command specifies the file system, subnet, and security group for + --ip-address-type IP-address-type + --ipv6-address IPv6-address \ @@ -82,0 +208,2 @@ The following example shows the command with sample data. + --ip-address-type DUAL_STACK \ + --ipv6-address 2001:0db8:85a3:0000:0000:8a2e:0370:7334 \ @@ -94,0 +222 @@ After successfully creating the mount target, Amazon EFS returns the mount targe + "Ipv6Address": "2001:0db8:85a3:0000:0000:8a2e:0370:7334",